PT-2026-26639 · Qnap · Qvr Pro

Fuzzinglabs · Publicado 2026-03-20 · Atualizado 2026-04-15 · CVE-2026-22898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QVR Pro versions prior to 2.7.4.14

Description QVR Pro is affected by a missing authentication check for critical functions, allowing remote attackers to gain access to the system. The issue allows attackers to bypass authentication and access QVR Pro surveillance systems. The vulnerability has a CVSS score of 9.3, indicating a critical severity. It is described as a 'network-accessible goldmine for instant system compromise'. No information is available regarding the number of potentially affected devices or real-world exploitation incidents.

Recommendations Update QVR Pro to version 2.7.4.14 or later.

Correção

RCE

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-22898

ZDI-26-292

Produtos afetados

Qvr Pro

Referências · 11

• https://twitter.com/infoflowcloud/status/2035621556601114912 · Publicação no Twitter
• https://qnap.com/en/security-advisory/qsa-26-07 · Aviso do Fabricante
• https://twitter.com/threatcluster/status/2036108147727733130 · Publicação no Twitter
• https://twitter.com/TheZDIBugs/status/2044537516628349234 · Publicação no Twitter
• https://twitter.com/f1tym1/status/2036143331835629706 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2035033421911564462 · Publicação no Twitter
• https://zerodayinitiative.com/advisories/ZDI-26-292 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-22898 · Nota de Segurança
• https://twitter.com/CVEnew/status/2035619798378516883 · Publicação no Twitter
• https://twitter.com/vuln_tracker/status/2035680699135717587 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/2035191254120898822 · Publicação no Twitter